Why Google Is Evil (and US in Germany, badBIOS)

For those of you who wonder why I “strongly dislike” Google, consider this trio of recent stories:

a) Google is now tracking smartphone users’ location all the time, determining which stores they visit, and connecting those visits to users’ Google searches

b) Google is now sending your Google+ (does anyone use that voluntarily except Dragos Ruiu? Why does he use the least-privacy-friendly most-prominently-connected-to-the-US-surveillance-state venues — G+, FB — for all his badBIOS stuff anyway? Someone get the man a shell account) photos to anyone you call

c) One more or less aveage blogger used Lightbeam to figure out who’s tracking him as he moves across the web. The results? Google was SIX TIMES as bad as anyone else! Granted, he’s a self-described abnormally heavy Google user… but even the Guardian’s survey found Google was worst of them all. [1]

Of course, as I write this, I’m conscious of the fact that I still have a Gmail account, used mostly for archiving 90% useless emails in an easily searchable way.

In that respect Google is very much the private sector NSA — when I started first becoming conscious of the whole surveillance thing, one of my thoughts was indeed, “crap, it’s too bad I can’t ask them what password I used for this this one thing a while back.”

Hey, even Mussolini made the trains run on time.

[1] http://www.theguardian.com/technology/interactive/2012/apr/23/tracking-trackers-companies-following-online

Understanding the US military and intelligence operation in Germany: Excellent article from John Goetz & co, even if it doesn’t get much beyond the official war-on-terror line. http://international.sueddeutsche.de/post/67469252824/frankfurt-an-american-military-intel-metropolis

#badBIOS in action, maybe. Dragos recorded some weird stuff going on on a Windows tablet. Anyone know Windows internals well enough to interpret? I get the feeling Windows is so complex, it looks pwned by DEFAULT. Dragos has pointed out in Twitter some of the stuff that looks very off (DHCP config being modified, etc) but I don’t have the patience for screenshot-reading, or the knowledge of late-model Windows plumbing hell to say. https://plus.google.com/103470457057356043365/posts/DjFLTvfrB2v https://www.youtube.com/watch?v=GL5NN-VxKB0

One reason #badBIOS is difficult to detect is because instead of modifying .exe’s directly, it applies patches to prefetch (.pf) files. https://twitter.com/dragosr/status/403582981526130689

@msuiche @aionescu to be explicit. if the pre-mapped area is messed with, the dexe disk file can be left virgin https://twitter.com/dragosr/status/403749718850682880

@bellytales @aionescu and more importantly, when I killed the pf files, procmon started reporting info again :)… for a short time 🙂 https://twitter.com/dragosr/status/403746293236789248

@msuiche @aionescu point taken. sigh. in any case let me put a disclaimer, the behviour I observed would be explained by this method https://twitter.com/dragosr/status/403750171466412032


“Tech companies large and small have long been trying to use smartphones to connect consumers’ online activity to what they do in “real” life. Google is now telling advertisers it has a way to do just that – and it involves tracking consumers’ smartphone locations all the time, wherever they go, even when they’re not using a Google app.

Google is beta-testing a program that uses smartphone location data to determine when consumers visit stores, according to agency executives briefed on the program by Google employees. Google then connects these store visits to Google searches conducted on smartphones in an attempt to prove that its mobile ads do, in fact, work.”


“Google’s desire to integrate social features into its mobile OS will soon see it use Google+ profile photos to identify Android callers. The new feature comes as an update to the new caller ID service in Android 4.4 KitKat, allowing the company to automatically match phone numbers from incoming and outgoing calls with names and profile photos associated with a registered account.”


“After a week of browsing with the Lightbeam add-on, I could see a list of all the sites that had been tracking me.[…]

Here’s a list of those sites, together with the company that owns the site:

Google: Google-analytics.com
Google: Doubleclick.net
Edgecast: Net-mine.com
Yahoo: Yieldmanager.com
Google: Ajax.googleapis.com
comScore: Scorecardresearch.com
eXelate Media: Exelator.com
AppNexus: Adnxs.com
Media Innovation Group: Mookie1.com
Demdex: Demdex.net
Google: Fonts.googleapis.com
Automattic: Gravatar.com
Specific Media: SpecificClick.net
Google: Googleadservices.com
Google: GoogleSyndication.com
Quantcast: Quantserve.com
Lotame: Crwdcntrl.net
Facebook: Facebook.net
Tribal Fusion: Tribalfusion.com
DirectREV: Directrev.com

So who was tracking me online? The simple answer was: Google and some other companies.

Here I’ve totalled up the connections across different companies:

Google: 207
Edgecast: 30
Yahoo: 26

In short, Google had over 6 as many connections to me as the rest of the web put together.”

%d bloggers like this: